WO2012174884A1

WO2012174884A1 - Access control method and device, interface and security gateway

Info

Publication number: WO2012174884A1
Application number: PCT/CN2012/071710
Authority: WO
Inventors: 朱李
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-06-21
Filing date: 2012-02-28
Publication date: 2012-12-27
Also published as: CN102843678A

Abstract

Disclosed are an access control method and device, an interface and a security gateway. The security gateway sends an access request message to an H(e)NB gateway and/or a network side access control related network element; the H(e)NB gateway and/or the network side access control related network element authenticates the access request message sent by the security gateway, and sends an access authentication reply message to the security gateway; and the security gateway receives the access authentication reply message sent by the H(e)NB gateway and/or the network side access control related network element. Compared with the prior art, the present invention improves the existing security architecture of an H(e)NB system, provides an efficient security solution related to an H(e)NB-GW, eliminates various security threats caused by a fake identity of an H(e)NB in the H(e)NB system, and enhances the security of the H(e)NB system.

Description

Access control method, device, interface and security gateway

Technical field

The present invention relates to the field of wireless cellular communication technologies, and in particular, to an access control method, apparatus, interface, and security gateway. Background technique

HNB (Home Node-B, Home Base Station) is used to provide 3G wireless coverage for 3G (3rd Generation Mobile Telecommunications System) handsets in the home. It is connected to existing residential broadband services. It includes the functionality of a standard Node B (an element of a 3G macro radio access network) and a standard RNC (Radio Network Controller) radio resource management function.

Figure 1 depicts the system architecture of HNB. The interface between the 3GPP (3rd Generation Partnership Project) user equipment and the HNB is a backhaul and compatible air interface in the UTRAN (Universal Terrestrial Radio Access Network). The HNB accesses the carrier's core network through a SeGW (security gateway). The broadband IP (Internet Protocol) backhaul between the HNB and the SeGW may be insecure. The information propagated during this backhaul is protected by a secure channel established between HNB and SeGW. SeGW performs mutual authentication on behalf of the carrier's core network and HNB. The HNB-GW (HNB Gateway) and the SeGW are logically separated entities in the core network of the operator, and are used for access control of a UE (User Equipment) that is not a CSG (Closed Subscriber Group). Hf^MS requires secure communication.

Figure 2 depicts the system architecture of the HeNB. The difference between the HeNB and the HNB is that it is an air interface that connects the 3GPP user equipment and the EUTRAN (Evolved Universal Terrestrial Radio Access Network). HeNB-GW (Home eNodeB Gateway, HeNB Gateway) is optional deployment. If the HeNB-GW is deployed, the SeGW and the HeNB-GW may be combined; if they are not combined, the interface between the SeGW and the HeNB-GW may be protected with NDS/IP. H(e)NB (Home (Evolved) NodeB, Home (Evolved) Base Station) includes HNB and HeNB, and is a general term for HNB and HeNB.

For the security of H(e)NB, 3GPP TR 33.820 defines 27 threats. These 27 threats are grouped into 7 categories. They are: Hazard to H(e)NB qualification, physical attack on H(e)NB, attack on H(e)NB construction, attack on H(e)NB protocol, on core network Attacks (including H(e)NB-based attacks), attacks on users' data and identity privacy, and attacks on wireless resources and management.

During the HNB registration process, the HNB sends an HNB REGISTER REQUEST message to the HNB-GW. The message contains: HNB location information, HNB identity, HNB management parameters, optional HNB management mode, and HNB's own IP address. The HNB-GW can use the information in the HNB REGISTER REQUEST message to check if the HNB registration is acceptable, including checking if an HNB is allowed to run at a given location.

In an actual application, if an attacker advertises an H(e)NB identity to the H(e)NB-GW, the ACL (Access Control List) check can be passed. Because the H(e)NB-GW holds the H(e)NB list that the UE can access, and the impersonated H(e)NB identity is included in this list, so that H(e)NB performs The access control will allow the UE to access the impersonated H(e)NB. This means that the attacker can impersonate another user's H(e)NB and be able to get calls from this user's ACL list. Therefore, as long as the attacker can find the identity of the corresponding H(e)NB, the attacker can potentially eavesdrop or impersonate any user belonging to the ACL.

This type of attack scenario can become very serious when an attacker impersonates an open (no CSG) H(e)NB because it can access a myriad of affiliated UEs.

In summary, the prior art has the following technical problems: The current H(e)NB security specification TS33.320 does not have any description of a solution involving such a threat. The impersonated H(e)NB can enable the UE to pass the access control of the H(e)NB-GW, and the current function of the H(e)NB-GW does not prevent such a threat from occurring. Summary of the invention The object of the present invention is to provide an access control method, device, interface and security gateway, which are solved

The security threat caused by the identity of the H(e)NB system.

To solve the above technical problem, the present invention provides an access control method, including: the security gateway sends an access request message to the H(e)NB gateway and/or the network side access control related network element;

The security gateway receives an access authentication reply message sent by the H(e)NB gateway and/or the network side access control related network element.

The access request message includes an identity of the H(e)NB and/or an H(e)NB access parameter.

The access request message sent by the security gateway is: a RADIUS message, or a Diameter message.

The security gateway sends the access request message through an interface established between the H(e)NB gateway and/or the network side access control related network element.

The network side access control related network element includes: a mobility management entity (MME) / a serving gateway (S-GW), a GPRS service support node (SGSN), a home location register (HLR) / a home subscriber server (HSS), dynamic Host Configuration Protocol (DHCP) server, RADIUS server, Diameter server, Authentication and Accounting and Accounting (AAA) server, and/or Mobile Switching Center (MSC) / Visit Location Register (VLR).

The H(e)NB access parameters include: H(e)NB location information, and/or H(e)NB management parameters, and/or H(e)NB operational status, and/or H(e)NB IP address;

The H(e)NB location information includes: a public IP address of a broadband access device of the H(e)NB, and

/ or IP address, and / or access line location identification, and / or macro cell information and / or geographic coordinates around H (e) NB.

To solve the above technical problem, the present invention further provides another access control method, including:

The H(e)NB gateway and/or the network side access control related network element authenticates the access request message sent by the security gateway, and sends an access authentication reply message to the security gateway.

The access authentication reply message includes an identity of the H(e)NB and/or an H(e)NB access parameter. The H(e)NB gateway and/or the network side access control related network element stores the body of the H(e)NB Binding information with H(e)NB access parameters.

The method further includes: the security gateway establishing an interface with the H(e)NB gateway and/or the network side access control related network element.

The step of authenticating the access request message by the H(e)NB gateway and/or the network side access control related network element includes:

The H(e)NB gateway and/or the network side access control related network element, according to the saved binding information, the identity of the H(e)NB included in the access request message, and/or H (e) NB access parameters for authentication; or, the H(e)NB gateway and/or the network side access control related network element access control related network element according to other network side accessing the binding information The binding information obtained in the access request message, the identity of the H(e)NB included in the access request message, and/or the H(e)NB access parameter is authenticated; or, the H(e) The NB gateway and/or the network side access control related network element forwards the received access request message to other network side access control related network elements storing the binding information, where the other storage has The network side access control related network element of the binding information performs authentication and reports the authentication result to the H(e)NB gateway and/or the network side access control related network element.

The location information of the H(e)NB includes: a public IP address of the broadband access device of the H(e)NB, and/or an IP address, and/or an access line location identifier, and/or H(e) Macro cell information and/or geographic coordinates around the NB.

The security gateway is protected from an interface between the H(e)NB gateway and/or the network side access control related network element. The present invention further provides an access control device, where the device is applied to an H(e)NB gateway and/or a network side access control related network element, and includes a binding information storage unit.

The binding information storage unit is configured to hold binding information of the identity of the H(e)NB and the H(e)NB access parameter.

The present invention also provides another access control device, characterized in that the device is applied to

The H(e)NB gateway and/or the network side access control related network element, and includes an access request authentication unit, where the access request authentication unit is configured to: perform an access request message sent by the received security gateway. The authentication sends an access authentication reply message to the security gateway, and includes an identity of the H(e)NB and/or an H(e)NB access parameter in the access authentication reply message.

The present invention also provides an access control interface, including an interface established between a security gateway and an H(e)NB gateway and/or a network side access control related network element;

The interface between the security gateway and the H(e)NB gateway and/or the network side access control related network element is set to:

And causing the security gateway to send an access request message to the H(e)NB gateway and/or the network side access control related network element through the interface; and/or

And causing the H(e)NB gateway and/or the network side access control related network element to send an access authentication reply message to the security gateway through the interface.

The access control interface further includes: the H(e)NB gateway is related to the network side access control An interface established between network elements;

The interface between the H(e)NB gateway and the network side access control related network element is set to: enable the H(e)NB gateway to store the identity of the H(e)NB and the H through the interface. (e) acquiring, by the network-side access control related network element of the binding information of the NB access parameter, the binding information;

Or, the H(e)NB gateway forwards the received access request message to the network side access control related network element that stores the binding information by using the interface, where the binding is stored. The network side access control related network element of the information authenticates the access request message; and the network side access control related network element storing the binding information stores the connection information according to the stored binding information After the incoming request message is authenticated, the authentication result is reported to the H(e)NB gateway through the interface.

An interface between the security gateway and the H(e)NB gateway and/or the network side access control related network element, and/or the H(e)NB gateway and the network side access control related network element The inter-interface is protected by NDS/IP and/or IPsec and/or Transport Layer Security (TLS) connections.

The present invention further provides a security gateway, including an access request initiating unit, where the access request initiating unit is configured to: send an access request message to an H(e)NB gateway and/or a network side access control related network element, And receiving an access authentication reply message sent by the H(e)NB gateway and/or the network side access control related network element.

The access request initiating unit is configured to send the access request message by using an interface established between the security gateway and the H(e)NB gateway and/or the network side access control related network element.

Compared with the prior art, the present invention improves the existing H(e)NB security architecture and provides

H(e)NB-GW related high-efficiency security solution solves various security threats caused by H(e)NB identity counterfeiting in H(e)NB system and increases the security of H(e)NB system Sex.

BRIEF abstract

The drawings are intended to provide a further understanding of the invention, and are intended to be illustrative of the invention. In the drawing:

Figure 1 is a schematic diagram of the system structure of the HNB; 2 is a schematic structural diagram of a system of a HeNB;

3 is a schematic diagram of an architecture of an EUTRAN including a HeNB GW;

4 is a schematic overall flow chart of an access control method of the H(e)NB system of the present invention;

FIG. 5 is a schematic flowchart of a method according to Embodiment 1 of the present invention; FIG.

6 is a schematic flow chart of a method according to Embodiment 2 of the present invention;

7 is a schematic flow chart of a method according to Embodiment 3 of the present invention;

8 is a schematic flow chart of a method according to Embodiment 4 of the present invention;

9 is a schematic flow chart of a method according to Embodiment 5 of the present invention;

10 is a schematic flow chart of a method according to Embodiment 6 of the present invention;

11 is a schematic flow chart of a method according to Embodiment 7 of the present invention;

FIG. 12 is a schematic flow chart of a method according to Embodiment 8 of the present invention. Preferred embodiment of the invention

In order to solve the huge security vulnerabilities and hazards caused by the H(e)NB identity impersonation security threat in the prior art, the main purpose of the present invention is to be in the UMTS (Universal Mobile Telephone System) network and EPS (Evolved Packet). In the security architecture of the System, the evolved packet system, a security mechanism of a HeNB (Home evolved Node-B) system related to an MME (Mobility Management Entity) is provided. Enhance the H(e)NB-GW function or interact with other network side network elements to achieve the purpose of preventing the threat of posing as H(e)NB.

To solve the security threats caused by the H(e)NB identity impersonation and to improve the security architecture of the H(e)NB system, the access control method in this embodiment performs the following processing:

The security gateway sends an access request message to the H(e)NB gateway and/or the network side access control related network element;

Access control method of the present embodiment, H(e)NB-GW and/or network side access control related network The element is processed as follows:

As shown in FIG. 4, an access control method for an H(e)NB system of the present embodiment uses the following technical solution:

Step 1: The binding information of the identity identifier (Identity) of the H(e)NB and the H(e)NB access related parameter stored in the H(e)NB-GW and/or the network side access control related network element.

Step 2: The SeGW establishes an interface with the H(e)NB-GW and/or the network side access control related network element.

Step 3: The SeGW sends an access request message to the H(e)NB-GW and/or the network side access control target network element.

Step 4: The H(e)NB-GW and/or the network side access control related network element authenticates the access request message.

Step 5: The H(e)NB-GW and/or the network side access control related network element sends an access authentication reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB connection. Enter the relevant parameters.

The identity of the H(e)NB and/or the H(e)NB access related parameter included in the access authentication reply message is used to indicate which H(e)NB is allowed to access and forward through the SeGW. Access the relevant parameters to the H(e)NB.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS. Server and/or Diameter server and/or AAA (Authentication Authorization and Accounting) server and/or MSC/VLR.

Further, the H(e)NB access related parameter includes H(e)NB location information and/or H(e)NB management parameter and/or H(e)NB operating state and/or H(e) ) NB's own IP address. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or a macro cell around the H(e)NB Information and/or geographic coordinates.

Further, the interface between the SeGW and the H(e)NB-GW and/or the network side access control related network element may be transmitted through NDS/IP and/or IPsec and/or TLS (Transport Layer Security). Layer security) is implemented to protect.

Further, in step 3, the access request message sent by the SeGW to the H(e)NB-GW may be a RADIUS (Remote Authentication Dial In User Service) message or a Diameter (upgraded version of the RADIUS protocol). Message.

Further, in step 3, the access request message sent by the SeGW to the H(e)NB-GW includes at least the identity of the H(e)NB and/or the H(e)NB access related parameter, H(e) The NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Further, in step 4, the H(e)NB-GW and/or the network side access control related network element authenticates the access request message, including: H(e)NB-GW and/or network side access Controlling the related network element to authenticate the access request message; or, the H(e)NB-GW and/or the network side access control related network element stores the identity of the H(e)NB and the H(e)NB from the other The network side access control network element that accesses the binding information of the relevant parameter obtains the binding information and performs authentication; or, the H(e)NB-GW and/or the network side access control related network element access the network element. The request message is forwarded to other network side access control network elements storing the binding information of the identity of the H(e)NB and the H(e)NB access related parameter, and is connected by other network side access control related network elements. The incoming request message is authenticated and reports the H(e)NB-GW and/or the network side access control related network element.

In order to make the objects, the technical solutions and the advantages of the present invention more clearly, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments of the present application may be arbitrarily combined with each other.

Embodiment 1

As shown in FIG. 5, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 501: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB with H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address . The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or Or Diameter server and / or AAA server and / or MSC / VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates.

Step 502: The SeGW establishes an NDS/IP and/or IPsec and/or TLS connection with the H(e)NB-GW and/or the network side access control related network element.

Step 503: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Step 504: The H(e)NB-GW and/or the network side access control related network element authenticates the access request message, and the authentication succeeds.

In this step, the identity of the H(e)NB and/or the H(e)NB access related parameter in the access request message are verified according to the saved binding information. If the authentication is successful, the authentication succeeds.

Step 505: The H(e)NB-GW and/or the network side access control related network element sends an access authentication success reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB. Access related parameters.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management Parameters and / or H (e) NB operating status and / or H (e) NB own IP address. Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Embodiment 2

As shown in FIG. 6, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 601: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB to the H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address . The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates.

Step 602: The SeGW establishes an NDS/IP and/or IPsec connection with the H(e)NB-GW and/or the network side access control related network element.

Step 603: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

Step 604: The H(e)NB-GW and/or the network side access control related network element authenticates the access request message, and the authentication fails.

Step 605: The H(e)NB-GW and/or the network side access control related network element fails to send the access authentication. The reply message is sent to the SeGW, which contains the identity of the H(e)NB and/or the H(e)NB access related parameters. The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Embodiment 3

As shown in FIG. 7, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 701: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB with H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address .

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates.

Step 702: The SeGW is established with the H(e)NB-GW and/or the network side access control related network element.

NDS/IP and / or IPsec connections.

Step 703: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

Step 704: The H(e)NB-GW and/or the network side access control related network element are connected from another network that stores the identity of the H(e)NB and the binding information of the H(e)NB access related parameter. The binding information of the identity of the H(e)NB and the related parameters of the H(e)NB access is obtained and authenticated in the control network element, and the authentication succeeds.

Step 705: The H(e)NB-GW and/or the network side access control related network element sends an access authentication success reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB. Access related parameters.

Embodiment 4

As shown in FIG. 8, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 801: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB with H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address . The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates.

Step 802: The SeGW establishes an NDS/IP and/or IPsec connection with the H(e)NB-GW and/or the network side access control related network element.

Step 803: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

Step 804, the H(e)NB-GW and/or the network side access control related network element from the network side of the binding information from the other H(e)NB stored identity and the H(e)NB access related parameter The access control network element obtains the binding information of the identity of the H(e)NB and the H(e)NB access related parameter, and performs authentication, and the authentication fails.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates. Step 805: The H(e)NB-GW and/or the network side access control related network element sends an access authentication failure reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB. Access related parameters.

Embodiment 5

As shown in FIG. 9, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 901: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB with H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address .

Step 902: The SeGW establishes an NDS/IP and/or IPsec connection with the H(e)NB-GW and/or the network side access control related network element.

Step 903: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC/VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Step 904: The H(e)NB-GW and/or the network side access control related network element forwards the access request message to other H(e)NB-stored identity and H(e)NB access related parameters. The network side of the binding information controls the related network element, and the other network side access control related network element authenticates the access request message, and reports to the H(e)NB-GW and/or the network side interface. Into the control network element, the authentication is successful.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR.

Step 905: The H(e)NB-GW and/or the network side access control related network element sends an access authentication success reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB. Access related parameters.

Embodiment 6

As shown in FIG. 10, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 1001: H(e)NB-GW and/or network-side access control related network element stores H (e) Binding information of the identity of the NB with H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address .

The network side access control related network element may be MME/S-GW and/or SGSN and/or HLR/HSS. And/or DHCP (Dynamic Host Configuration Protocol) server and/or RADIUS server and/or Diameter server and/or AAA server and/or MSC/VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates.

Step 1002: The SeGW establishes an NDS/IP and/or IPsec connection with the H(e)NB-GW and/or the network side access control related network element.

Step 1003: The SeGW sends an access RADIUS or Diameter request message to the H(e)NB-GW and/or the network side access control related network element, where the access request message includes at least the identity of the H(e)NB and/or Or H(e)NB access related parameters.

Step 1004: The H(e)NB-GW and/or the network side access control related network element forwards the access request message to other H(e)NB-stored identity and H(e)NB access related parameters. The network side of the binding information controls the related network element, and the other network side access control related network element authenticates the access request message, and reports to the H(e)NB-GW and/or the network side access control. The related NE failed to be authenticated.

Step 1005: The H(e)NB-GW and/or the network side access control related network element sends an access authentication failure reply message to the SeGW, where the message includes the identity of the H(e)NB and/or H(e)NB Access related parameters. The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates.

Example 7

As shown in FIG. 11, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 1101: The identity of the H(e)NB and the H(e) are stored in the network element related to the network side access control. Binding information of NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address.

Step 1102: The SeGW establishes an NDS/IP and/or IPsec connection with the network side access control related network element.

Step 1103: The SeGW sends an access RADIUS or Diameter request message to the network side access control related network element, where the access request message includes at least an identity of the H(e)NB and/or an H(e)NB access related parameter. .

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Where H(e)NB is located The information includes the public IP address and/or IP address and/or access line location identity of the broadband access device of the H(e)NB and/or macrocell information and/or geographic coordinates around the H(e)NB.

Step 1104: The network side access control related network element authenticates the access request message, and the authentication succeeds.

Step 1105: The network side access control related network element sends an access authentication success reply message to the SeGW, where the message includes the identity of the H(e)NB and/or the H(e)NB access related parameter.

Example eight

As shown in FIG. 12, the access control scheme of the H(e)NB system in this embodiment is specifically described as follows: Step 1201: The identity of the H(e)NB and the H(e) are stored in the network element related to the network side access control. Binding information of NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB's own IP address.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB and / or geographic coordinates. Step 1202: The SGW establishes an NDS/IP and/or IPsec connection with the network side access control related network element.

Step 1203: The SeGW sends an access RADIUS or Diameter request message to the network side access control related network element, where the access request message includes at least an identity of the H(e)NB and/or an H(e)NB access related parameter. .

Step 1204: The network side access control related network element authenticates the access request message, and the authentication fails.

Step 1205: The network side access control related network element sends an access authentication failure reply message to the SeGW, where the message includes an identity of the H(e)NB and/or an H(e)NB access related parameter.

The network side access control related network element may be an MME/S-GW and/or an SGSN and/or an HLR/HSS and/or a DHCP (Dynamic Host Configuration Protocol) server and/or a RADIUS server and/or a Diameter. Server and / or AAA server and / or MSC / VLR. The H(e)NB access related parameters include H(e)NB location information and/or H(e)NB management parameters and/or H(e)NB operational status and/or H(e)NB own IP address. . Wherein the H(e)NB location information includes a public IP address and/or an IP address and/or an access line location identifier of the broadband access device of the H(e)NB and/or macro cell information around the H(e)NB And / or geographic coordinates. In addition, the embodiment of the present invention further provides an access control apparatus, which is applied to an H(e)NB gateway and/or a network side access control related network element, where the apparatus includes a binding information storage unit.

Further, the H(e)NB access parameters include: H(e)NB location information, and/or H(e)NB management parameters, and/or H(e)NB operational status, and/or H (e) the IP address of the NB;

In addition, the embodiment of the present invention further provides another access control apparatus, which is applied to an H(e)NB gateway and/or a network side access control related network element, where the apparatus includes an access request authentication unit. The access request authentication unit is configured to authenticate the access request message sent by the received security gateway, send an access authentication reply message to the security gateway, and include the identity of the H(e)NB in the access authentication reply message. And / or H (e) NB access parameters.

Further, the H(e)NB access parameters include: H(e)NB location information, and/or H(e)NB management parameters, and/or H(e)NB operational status, and/or H( e) the IP address of the NB;

In addition, an embodiment of the present invention further provides an access control interface, which includes an interface established between a security gateway and an H(e)NB gateway and/or a network side access control related network element;

The interface between the security gateway and the network element associated with the network gateway and/or network side access control is set to:

And causing the H(e)NB gateway and/or the network side access control related network element to send an access authentication reply message to the security gateway by using the interface. Further, the access control interface further includes an interface established between the H(e)NB gateway and the network side access control related network element;

The interface between the H(e)NB gateway and the network side access control related network element is set to: enable the H(e)NB gateway to store the identity of the H(e)NB and the H(e) through the interface. Obtaining the binding information in a network-side access control related network element of the binding information of the NB access parameter;

Or, the H(e)NB gateway forwards the received access request message to the network side access control related network element that stores the binding information through the interface, where the network side access control is related. The network element authenticates the access request message; and the network side access control related network element storing the binding information authenticates the access request message according to the stored binding information, and then passes The interface reports the authentication result to the H(e)NB gateway.

Further, an interface between the security gateway and the H(e)NB gateway and/or the network side access control related network element, and/or an interface between the H(e)NB gateway and the network side access control related network element Protection is provided by NDS/IP and/or IPsec and/or TLS connections.

In addition, in the embodiment of the present invention, a security gateway is further provided, where the security gateway includes an access request initiating unit.

The access request initiating unit is configured to: send an access request message to the H(e)NB gateway and/or the network side access control related network element, and receive the H(e)NB gateway and/or the network side connection. The access control response message sent by the relevant network element is controlled.

Further, the access request initiating unit is configured to send the access request message by using an interface established between the security gateway and the H(e)NB gateway and/or the network side access control related network element.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. The present invention may be embodied in various other embodiments without departing from the spirit and scope of the invention. Various changes and modifications may be made to the invention, and such changes and modifications are intended to be included within the scope of the appended claims.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be executed by a computing device The program code is implemented so that they can be stored in the storage device by the computing device, and in some cases, the steps shown or described can be performed in a different order than here, or they can be separately produced. The individual integrated circuit modules are implemented, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

Industrial Applicability Compared with the prior art, the present invention improves the existing H(e)NB security architecture, provides an efficient security solution related to H(e)NB-GW, and solves H(e)NB The security of the H(e)NB system is increased due to various security threats caused by H(e)NB identity spoofing in the system.

Claims

Claim

1. An access control method, comprising:

2. The method of claim 1 wherein

3. The method of claim 1, wherein

4. The method of claim 1, 2 or 3, wherein

5. The method of claim 1, wherein

6. The method of claim 2, wherein the H(e)NB access parameters comprise: H(e)NB location information, and/or H(e)NB management parameters, and/or H(e) NB operating status, and / or H (e) NB's IP address;

The H(e)NB location information includes: a public IP address, and/or an IP address, and/or an access line location identifier of the broadband access device of the H(e)NB, and/or around the H(e)NB Macro cell information and/or geographic coordinates.

7. An access control method, comprising: The H(e)NB gateway and/or the network side access control related network element authenticates the access request message sent by the security gateway, and sends an access authentication reply message to the security gateway.

8. The method of claim 7, wherein

The access authentication reply message includes an identity of the H(e)NB and/or an H(e)NB access parameter.

9. The method of claim 7, wherein

Binding information of the identity of the H(e)NB and the H(e)NB access parameter is saved in the H(e)NB gateway and/or the network side access control related network element.

10. The method of claim 7, 8 or 9, further comprising:

The security gateway establishes an interface with the H(e)NB gateway and/or the network side access control related network element.

11. The method of claim 9, wherein

The H(e)NB gateway and/or the network side access control related network element, according to the saved binding information, the identity of the H(e)NB included in the access request message, and/or H (e) NB access parameters for authentication;

Or the H(e)NB gateway and/or the network side access control related network element according to the binding information acquired from other network side access control related network elements storing the binding information, Authenticating the identity of the H(e)NB included in the access request message, and/or the H(e)NB access parameter; or the H(e)NB gateway and/or network side access control The related network element forwards the received access request message to other network-side access control related network elements that store the binding information, and the other network side access control that stores the binding information The related network element performs authentication and reports the authentication result to the H(e)NB gateway and/or the network side access control related network element.

12. The method of claim 7, wherein

The network side access control related network element includes: a mobility management entity (MME) / a service gateway

(S-GW), GPRS Service Support Node (SGSN), Home Location Register (HLR) / Home Subscriber Server (HSS), Dynamic Host Configuration Protocol (DHCP) server, RADIUS server, Diameter server, Authentication and Accounting and Accounting (AAA) server, and/or Mobile Switching Center (MSC) / Visit Location Register (VLR).

13. The method according to claim 8 or 9, wherein

14. The method of claim 10, further comprising: protecting the interface between the H(e)NB gateway and/or the network side access control related network element.

An access control device, where the device is applied to an H(e)NB gateway and/or a network side access control related network element, and includes a binding information storage unit.

16. The apparatus according to claim 15, wherein

An access control device, wherein the device is applied to an H(e)NB gateway and/or a network side access control related network element, and includes an access request authentication unit,

The access request authentication unit is configured to: authenticate the access request message sent by the received security gateway, send an access authentication reply message to the security gateway, and include H in the access authentication reply message ( e) NB identity and/or H(e)NB access parameters.

18. The apparatus according to claim 17, wherein The H(e)NB access parameters include: H(e)NB location information, and/or H(e)NB management parameters, and/or H(e)NB operational status, and/or H(e)NB IP address;

An access control interface, comprising: an interface established between a security gateway and an H(e)NB gateway and/or a network side access control related network element;

The access control interface of claim 19, further comprising an interface established between the H(e)NB gateway and the network side access control related network element;

21. The access control interface of claim 20, wherein

22. A security gateway, including an access request initiation unit, The access request initiating unit is configured to: send an access request message to the H(e)NB gateway and/or the network side access control related network element, and receive the H(e)NB gateway and/or the network side Access control access reply message sent by the relevant network element.

23. The security gateway of claim 22, wherein